IT Security and Systems Engineer

SilencerCo•Kearns, UT

6d•Onsite

About The Position

SicoSyndicate is the shared services company behind SilencerCo, Zev Technologies, Unity Tactical, and other companies. Its shared IT function serves all business units. The IT Security and Systems Engineer will drive security across those businesses and serve as the company-wide subject matter expert for security and compliance. The position reports to the Senior IT Manager and works directly with the Chief Technology Officer on security strategy, framework roadmaps, and risk decisions. This is a hands-on role on a small team, with security and compliance as the primary focus and systems engineering as a substantial part of the work. The engineer will own compliance programs and security and infrastructure projects while remaining technically engaged across the broader environment. The role includes working alongside the core IT team on infrastructure, systems, and technology initiatives beyond security. The organization is lean and expects employees to contribute beyond narrow job descriptions. The engineer will own outcomes and project delivery, communicate risks and status proactively, and work with leadership and business unit stakeholders. Success is measured by demonstrable outcomes, including CMMC Level 2 readiness, timely delivery of security and compliance projects, vulnerability remediation, practical policies, and early engagement by business leaders on security-related decisions.

Requirements

8 to 12 years of experience in IT, with meaningful depth in security and compliance.
Direct experience with at least one government contracting framework, ideally NIST SP 800-171 or CMMC.
Working knowledge of at least one commercial framework such as SOC 2, PCI DSS, or ISO 27001.
A track record of running projects from kickoff through completion on committed timelines, including projects identified and proposed independently.
Strong general IT fundamentals, including Windows and Linux servers, Microsoft 365 administration, identity and access management, networking, and Windows and Mac endpoint management.
CompTIA Security+ certification or equivalent certification.
Good judgment in determining when a control needs to be enforced and when it should be adapted to how the business operates.
Clear written communication skills, including the ability to produce documentation for auditors and executives.
Ability to communicate clearly with non-technical audiences and defend recommendations.
Ability to own outcomes, proactively surface risks, and keep stakeholders informed.

Nice To Haves

CISA, CCSP, CySA+, or CMMC CCP certification.
Experience supporting a company through a CMMC assessment.
Manufacturing or regulated industry background.
Familiarity with ITAR or EAR export control requirements.
ERP exposure, particularly Odoo.
Cloud security experience in AWS and Azure.

Responsibilities

Lead readiness and ongoing compliance for CMMC Level 2 and NIST SP 800-171 across defense-adjacent business units.
Support SOC 2 and PCI DSS efforts, including evidence collection, control design, gap remediation, and audit coordination.
Own security and infrastructure projects end to end: scope projects, build plans, coordinate vendors and internal stakeholders, drive delivery to agreed timelines, and keep leadership informed about status and risk.
Administer and improve security tooling, including endpoint protection, identity and access management, SIEM, MFA, email security, vulnerability management, and logging.
Run access reviews, security awareness training, phishing simulations, and incident response tabletop exercises.
Write and maintain policies, procedures, and system security plans required by applicable frameworks, ensuring they reflect actual business practices.
Partner with business unit leaders on risk decisions, vendor reviews, and security questions from customers and partners.
Work with the core IT team on systems and infrastructure initiatives beyond security, including Microsoft 365/Entra ID and identity administration, server and network projects, endpoint management, and other technology work supporting all business units.
Surface project risks early, keep stakeholders informed, and communicate schedule changes before deadlines are missed.
In the first year, complete a CMMC Level 2 gap assessment, write the System Security Plan, and execute a plan with defensible dates.
Remediate critical and high vulnerabilities within defined windows and show the remediation trend.
Ensure security policies reflect actual business operations and are followed.
Build trust with business unit leaders so they seek security input early on relevant decisions.